Bug 1849332 - Ensure URL::SetPort rejects values with leading non-numeric junk. r=necko-reviewers,valentin

Differential Revision: https://phabricator.services.mozilla.com/D186536

dom/url/URL.cpp

@@ -315,8 +315,13 @@ void URL::SetPort(const nsAString& aPort) {
   int32_t port = -1;
 
   // nsIURI uses -1 as default value.
+  portStr.StripTaggedASCII(ASCIIMask::MaskCRLFTab());
   if (!portStr.IsEmpty()) {
-    portStr.StripTaggedASCII(ASCIIMask::MaskCRLFTab());
+    // To be valid, the port must start with an ASCII digit.
+    // (nsAString::ToInteger ignores leading junk, so check before calling.)
+    if (!IsAsciiDigit(portStr[0])) {
+      return;
+    }
     port = portStr.ToInteger(&rv);
     if (NS_FAILED(rv)) {
       return;

testing/web-platform/meta/url/url-setters-stripping.any.js.ini

@@ -238,9 +238,6 @@
   [Setting pathname with middle U+000A (wpt++:)]
     expected: FAIL
 
-  [Setting port with leading U+0000 (https:)]
-    expected: FAIL
-
   [Setting pathname with leading U+000D (wpt++:)]
     expected: FAIL
 
@@ -280,9 +277,6 @@
   [Setting pathname with middle U+001F (wpt++:)]
     expected: FAIL
 
-  [Setting port with leading U+001F (https:)]
-    expected: FAIL
-
   [Setting host with trailing U+000A (wpt++:)]
     expected: FAIL
 
@@ -572,9 +566,6 @@
   [Setting pathname with middle U+000A (wpt++:)]
     expected: FAIL
 
-  [Setting port with leading U+0000 (https:)]
-    expected: FAIL
-
   [Setting pathname with leading U+000D (wpt++:)]
     expected: FAIL
 
@@ -614,9 +605,6 @@
   [Setting pathname with middle U+001F (wpt++:)]
     expected: FAIL
 
-  [Setting port with leading U+001F (https:)]
-    expected: FAIL
-
   [Setting host with trailing U+000A (wpt++:)]
     expected: FAIL